MAC bridging and sniffing packets with specific Ethertype

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Kamila (camol_at_gazeta.pl)
Date: 10/13/04

  • Next message: Jeff Kelley [MS]: "Re: MAC bridging and sniffing packets with specific Ethertype" 
    Date: 13 Oct 2004 09:39:37 -0700

    We are considering development of a simple bridge base on the Windows
    CE 4.2 or 5.0.
    We plan to use Mbridge.dll for this purpose. On one of the interfaces
    (802.3) additionally to the IP traffic, which will be bridged, there
    will traffic destined to the bridge interface card. The bridge will
    use this traffic to exchange with the device, directly connected to
    this interface, some configuration information. The proprietary
    protocol will be used for this purpose. This protocol is defined
    directly above Ethernet header (no IP header). We want to filter this
    traffic based on the Ethertype or SNAP header.

    It looks like that it is possible to write an application to receive
    and send Ethernet packet using NDISUIO protocol driver (ReadFile,
    WriteFile operations). There is an IOCTL_NDISUIO_SET_ETHER_TYPE
    operation allowing to set type of Ethernet packet to be filtered (by
    default it is 0x8001).
    If we change it, does it mean that application will receive only this
    type of Ethernet packets or the NDIS driver will filter these packets
    and won't allow receiving any other packets on this interface?
    Would it take any effect on the Mbridge? Will the Mbridge module
    receive packets with other Ethertypes from this interface?
    What about packets filtered by our application? Would they be sent to
    the Mbridge module as well? I found info in the msdn that for the
    simultaneous access for multiple application operations requiring
    packets replication within NDIS are not supported. However in this
    case the Mbridge is not typical application acting in the user mode,
    it operates in the kernel mode. Does it matter in this case?

    If you could provide me with some example code to filter Ethernet
    packets with specific Ethertype field, it would be great!

    Maybe I am wrong approaching the problem in this way. Any advises?

    Thanks in advance for any help!

    Kamila Piechota

  • Next message: Jeff Kelley [MS]: "Re: MAC bridging and sniffing packets with specific Ethertype"

    Relevant Pages

    • Re: PF, bridge, states and window scaling problem
      ... My problem comes with the filter rules. ... the bridge use TCP window scaling. ... but not matched by the rest of the packets ... statefull firewall has an unpredictable behaviour on bridges. ...
      (freebsd-questions)
    • Re: more on pfil and bridging
      ... Instead of the bridge registering a separate filter queue for itself, ... bridged packets as "normal" L2 packets. ...
      (freebsd-net)
    • Re: more on pfil and bridging
      ... Instead of the bridge registering a separate filter queue for itself, ... It should register its own stack and each filter type should ... Ather and bridge need to be distinguishable. ... bridged packets as "normal" L2 packets. ...
      (freebsd-net)
    • Re: How to set NIC to promiscuous mode from FilterHook driver
      ... So from your reply I take it you are interested in getting packets destined to other hosts -that are not necessarily originated from the host your filter is running on-. ... As I said in my previous post, setting the adapter to promiscuous mode is not going to help you. ... the filter hook driver I mentioned is as per the msdn ...
      (microsoft.public.development.device.drivers)
    • Re: Traffic control: throttling downloads
      ... The easiest way is if you are just routing, then you can add a qdisc to the lan facing interface and shape traffic as you would for upstream. ... tc filter add dev eth0 protocol ip prio 1 parent ffff: ... The first filter matches tcp packets with length < 128 bytes by using a match of 0x0000 and a mask of 0xff80 starting at byte 2 of the ip packet, which is length - you can only match powers of 2 like this. ... If you want to use normal qdiscs on ingress traffic you have to use ifb. ...
      (comp.os.linux.networking)